CVE-2017-9805

high Apache ⚠️ CISA KEV — Exploited in the Wild
CVSS v3 Base Score
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
94.3%
Exploitation probability in 30 days
Top 0% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Published: September 15, 2017 (3162 days ago)
Last Modified: April 21, 2026
Vendor: Apache
Source: NVD

⚠️ CISA Known Exploited Vulnerability

Added to KEV: 2021-11-03
Remediation Due: 2022-05-03 (⚠ 1472d overdue)

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

CWE

CWE-502

Affected Products

apache strutscisco digital media managercisco hosted collaboration solutioncisco media experience enginecisco network performance analysiscisco video distribution suite for internet streamingnetapp oncommand balance

References

🔗 www.oracle.com 🔗 www.securityfocus.com 🔗 www.securitytracker.com 🔗 blogs.apache.org 🔗 bugzilla.redhat.com